Title
#general
z

Zohaib Nasir

08/11/2022, 6:06 PM
Hi everyone, osquery service is not connecting with fleet server. i have tried below commands to connect osquery service to fleet server but unable to connect to fleet server. sc.exe create osqueryd type= own start= auto binpath= ""C:\Program Files\osquery\osqueryd\osqueryd.exe" --flagfile="C:\Program Files\osquery\osquery.flags"" displayname= osqueryd .\manage-osqueryd.ps1 -install -startupArgs "C:\Program Files\osquery\osquery.flags" :"C:\Program Files\osquery\osqueryd\osqueryd.exe" --flagfile="C:\Program Files\osquery\osquery.flags" --install Here is my flagfile (osquery.flags)

Server

--tls_hostname=MyIP:8080 --tls_server_certs="C:\Program Files\osquery\certs\fleet.pem"

Enrollment

--host_identifier=instance --enroll_secret_path="C:\Program Files\osquery\certs\enroll_secret" --enroll_tls_endpoint="C:\Program Files\osquery"

Configuration

--config_plugin=tls #--config_tls_endpoint=/api/v1/osquery/config --config_tls_endpoint="C:\Program Files\osquery\osquery.conf" --config_refresh=10

Live query

--disable_distributed=false --distributed_plugin=tls --distributed_interval=10 --distributed_tls_max_attempts=3 --distributed_tls_read_endpoint="C:\Program Files\osquery\certs" --distributed_tls_write_endpoint="C:\Program Files\osquery"

Logging

--logger_plugin=tls --logger_tls_endpoint="C:\Program Files\osquery\log"

File carving

--disable_carver=false #--carver_start_endpoint=/api/v1/osquery/carve/begin #--carver_continue_endpoint=/api/v1/osquery/carve/block --carver_block_size=2000000 Please identify the issue.